Inverter communication protocol

Version information

Version Date Remarks Author

V 1.0 2017.09.09 Vincent
V 1.1 2017.10.08 Vincent
Modify number of register to 2bytes when
V 1.2 2018.03.28 Vincent
Master to read data
1 Communication flow chart:

Slave
Maste Device MODBUS(RS485)/9600bps
Device(Inverter)

2 Communication description:

RS485/MODBUS-RTU Communication

Communication interface: RS485

Communication connection mode: two-wire( RS85+,RS485- ),shielded twisted pair conductors

Communication working mode: half-duplex

Communication speed: 9600bps

3 Transmission mode :

The information transmit in asynchronous mode in bytes , The Communication information

transmitting between the host computer and the slave computer is the 10 bits format, including
one initial bit ,8 data bit(Firstly Transmitting the least effective bit ). Without parity check bit . 1
stop bit .

Data frame format

Address code Function Data area CRC check code
1 byte 1 byte n byte 2 byte

Address code: address code is loacated at beginning of frame ,decimal system is 1~247 in the
inverter; The default address is 85

Function code: function code tell the target terminal to execute what function, Below table list:
function code used in this inverter, and their meaning and function.

Function Definition Operation

03H (Hexadecimal) Read data register Obtain current binary system
value of one or multiple
register

Data area: data area includes the data needed by terminal for executing specific function, or the
collected data when terminal is responding enquiry.

CRC check code : Error check(CRC) domain occupies 2 byte, including one 16 bit binary system
value. CRC value is calculated by transmission device . and then attached to the data frame, the
receiving device . while receiving, it calculates the CRC value again ,then comparing it with the
receiving CRC domain value ,if these two values are not equal, it an error occurs.

Base on C language for CRC check code :

u16 CRC16_Check(const u8 *P ,u16 ubCRCNum) //CRC check code
{
u8 temp;
u8 i;
u16 c;
u8 TT;
u16 crc = 0xffff;
for(c=0;c<ubCRCNum;c++)
{
temp = P[c];
crc =crc^temp;
for(i=0;i<8;i++)
{
TT = crc & 1;
crc = crc>>1;
crc = crc&0x7fff;
if(TT == 1)
{
crc = crc^0xa001;
}
crc = crc&0xffff;
}
}
return crc;
}
Communication parameter address table and application
details :

Address variable Belo Data Data Remarks

Register ng format Model
to
R/W
0000H Inverter storage active power R Occupy WORD 1w/bit ;
2 byte (short) (-1000) represents
active power of
charging 1000W ;
(+1000) represents
active power of
discharging 1000W ;

0001H Inverter storage reactive power R Occupy WORD 1w/bit ;

2 byte (short) (-1000) represents
reactive power of
charging 1000W ;
(+1000) represents
reactive power of
discharging 1000W ;
0002H Force storage to reach SOC R Occupy WORD 0.1/bit ;
2 byte (unsigned (950) *0.1 = 95% ;
short) Soc is 95%

0003H power grid dispatching R Occupy WORD

1:start
2 byte (unsigned
0:stop
short)
0004H Control mode R Occupy WORD 1:Battery only
2 byte (unsigned charges from PV
short) 2:State of Charge
control
3:Load Following
0005H Active power of A phase(meter) R Occupy WORD
2 byte (short) 1w/bit

0006H Active power of B phase(meter) R Occupy WORD

2 byte (short) 1w/bit

0007H Active power of C phase(meter) R Occupy WORD

2 byte (short) 1w/bit

0008H Total Active power(meter) R Occupy WORD 1w/bit

2 byte (short)

0009H Current forward active total R Occupy DWORD 0.01KWh/bit

000AH electric energy(meter) 4 byte (unsigned
int)

000BH Current reversing active total R Occupy DWORD

0.01KWh/bit
000CH electric energy(meter) 4 byte (unsigned
int)
000DH Aux_imported_energy R Occupy DWORD 0.01KWh/bit
000EH 4 byte (unsigned
int)

000FH Aux_I R Occupy WORD 0.1A/bit example：

2 byte (short) send Iset=0x0064,
(0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
0010H Battery voltage R Occupy WORD
2 byte (unsigned 0.02V/bit
short)
0011H Battery current R Occupy WORD 0.1A/bit ,
2 byte (short) -100 = -100*0.1 = -
10A,Chargeing
current is 10 A;
0012H Battery_voltage_backup R Occupy WORD 0.02V/bit
2 byte (unsigned example：send Vset
short) =2500，
corresponding to the
voltage of 50V

0013H Average_battery_temp R Occupy WORD

1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
(FFD8)Hex=

(-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃

0014H Average_battery_temp_backup R Occupy WORD

1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
(FFD8)Hex=

(-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃
0015H Cell_avg_temp R Occupy WORD
1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
(FFD8)Hex=

(-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃

0016H Cell_stdev_temp R Occupy WORD

1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
(FFD8)Hex=

(-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃

0017H Cell_temp_min R Occupy WORD

1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
(FFD8)Hex=

(-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃

0018H Cell_temp_max R Occupy WORD

1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
 (FFD8)Hex=

(-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃

0019H Cell_stdev_v R Occupy WORD 0.001v/bit example：

2 byte (unsigned send Vset =3500,
short) corresponding to the
voltage of 3.5V
001AH Cell_avg_v R Occupy WORD 0.001v/bit example：
2 byte (unsigned send Vset =3500,
short) corresponding to the
voltage of 3.5V
001BH Cell_voltage_min R Occupy WORD 0.001v/bit example：
2 byte (unsigned send Vset =3500,
short) corresponding to the
voltage of 3.5V
001CH Cell_voltage_max R Occupy WORD 0.001v/bit example：
2 byte (unsigned send Vset =3500,
short) corresponding to the
voltage of 3.5V
001DH Grid_P R Occupy WORD 1w/bit charge:<0
2 byte (short) discharge:>0
example：send Pset
=0xFC18,
,(FC18)Hex = (-
1000)Dec
corresponding to the
charge power of
1000w
001EH Version identification R Occupy WORD
1:normal version ;
2 byte (unsigned
2:Parallel version
short)
001FH Meter_P R Occupy WORD 1w/bit charge:<0
2 byte (short) discharge:>0
example：send Pset
=0xFC18,
,(FC18)Hex = (-
1000)Dec
corresponding to the
 charge power of
1000w

0020H DCMeter_P R Occupy WORD 1w/bit charge:<0

2 byte (short) discharge:>0
example：send Pset
=0xFC18,
,(FC18)Hex = (-
1000)Dec
corresponding to the
charge power of
1000w
Grid_V1 R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
0021H short) =2500,
corresponding to the
voltage of 250V
0022H Grid_V2 R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
0023H Grid_V3 R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
0024H Inverter_Backup_V1 R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
0025H Inverter_Backup_V2 R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
0026H Inverter_Backup_V3 R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
0027H Inverter_AC_I1 R Occupy WORD 0.1A/bit example：
2 byte (short) send Iset=0x0064,
(0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
0028H Inverter_AC_I2 R Occupy WORD 0.1A/bit example：
2 byte (short) send Iset=0x0064,
(0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
0029H Inverter_AC_I3 R Occupy WORD 0.1A/bit example：
2 byte (short) send Iset=0x0064,
(0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
002AH Grid_state R Occupy WORD 1: System_off
2 byte (unsigned 2: Standby
short) 3: AC_connected
4: Inverting
5: Synchronising
6: Test_condition
002BH Supervisory_state R Occupy WORD Bit 0: Idle 0: disable
2 byte (unsigned dispatch 1:enable
short) dispatch
Bit 1: Grid charging flag
0:not 1:yes
Bit 2: solarcharging flag
0:not 1:yes
Bit 3: Discharging flag
0:not 1:yes
Bit 4: work mode
1:work 0:standby
Bit 5: Islanded 0:not
1:yes
002CH Inverter_core_temp R Occupy WORD
1℃/bit example：
2 byte (short)
send Tset =0xFFD8
corresponding to the
temperature：
(FFD8)Hex=
 (-40)Dec = -40℃，

Data Range：
0~FFFFH
Effective Value：

-40℃～125℃

002DH State_of_charge R Occupy WORD 0.4%/bit

2 byte (unsigned example：Send
short) SOC =95,
corresponding to the
SOC of 38%.
002EH PV1 Voltage R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
002FH PV1 Current R Occupy WORD 0.1A/bit example：
2 byte (unsigned send Iset=0x0064,
short) (0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
0030H PV1 power R Occupy WORD 1w/bit example：
2 byte (unsigned send Pset =0x03E8,
short) ,( 03E8)Hex =
(1000)Dec
corresponding to the
power of 1000w
0031H PV2 Voltage R Occupy WORD 0.1V/bit
2 byte (unsigned example：send Vset
short) =2500,
corresponding to the
voltage of 250V
0032H PV2 Current R Occupy WORD 0.1A/bit example：
2 byte (unsigned send Iset=0x0064,
short) (0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
0033H PV2 power R Occupy WORD 1w/bit example：
2 byte (unsigned send Pset =0x03E8,
short) ,( 03E8)Hex =
 (1000)Dec
corresponding to the
power of 1000w
0034H Feed into grid percent R Occupy WORD 1%/bit
2 byte (unsigned Range:0~100
short) example：send
percent =25, feed
into grid percent
25%.
0035H Grid Frequency R Occupy WORD
2 byte (unsigned 0.01Hz/bit
short)
0036H Grid_I1 R Occupy WORD 0.1A/bit example：
2 byte (short) send Iset=0x0064,
(0064)Hex =
(+100)Dec,
corresponding to the
current of 10A
0037H Reactive Power of DC Meter R Occupy WORD 10var/bit
2 byte (unsigned example：send
short) Power=0x03E8,
corresponding to the
Reactive power of
10000var
0038H System warning R Occupy WORD
2 byte (unsigned TBD
short)
0039H System fault R Occupy WORD
2 byte (unsigned TBD
short)
003AH Battery warning R Occupy WORD
2 byte (unsigned Note 1
short)
003BH Battery fault R Occupy WORD
2 byte (unsigned Note 2
short)
003CH Inverter warning R Occupy WORD
2 byte (unsigned Note 3
short)
003DH Inverter fault R Occupy WORD
2 byte (unsigned Note 4
short)
003EH EMS SN byte1-2 R Occupy WORD EMS SN :ASCII
2 byte (unsigned FORM.
short) 0x3132==’12’
003FH EMS SN byte3-4 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0040H EMS SN byte5-6 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0041H EMS SN byte7-8 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0042H EMS SN byte9-10 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0043H EMS SN byte11-12 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0044H EMS SN byte13-14 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0045H EMS SN byte15-16 R Occupy WORD
EMS SN :ASCII
2 byte (unsigned
0x3132==’12’
short)
0046H System_time：(year)- (month) R Occupy WORD Data format hex；
2 byte (unsigned 0xyymm，
short) example：Send
0x1109;
year:0x11(2017)
month:0x09(09);
0047H System_time： (day) -(hour) R Occupy WORD Data format hex；
2 byte (unsigned 0xddhh，
short) example：Send
0x1109;
day:0x11(The 17
day)
hour:0x09(09);
0048H System_time： R Occupy WORD Data format hex；
(minute)- (second) 2 byte (unsigned 0xmmss，
short) example：Send
0x1109;
min:0x11(17)
second:0x09(09);
0049H EMS Soft Version 1-2 R Occupy WORD
2 byte (unsigned EMS Soft
short) Version :ASCII
0x312E==’1.’

004AH EMS Soft Version 3-4 R Occupy WORD

2 byte (unsigned EMS Soft
short) Version :ASCII
0x3031==’01’

004BH EMS Soft Version 5-6 R Occupy WORD

2 byte (unsigned EMS Soft
short) Version :ASCII
0x2E38==’.8’

004CH EMS Soft Version 7-8 R Occupy WORD

2 byte (unsigned EMS Soft
short) Version :ASCII
0x34==’4’

004DH EMS Hard Version 1-2 R Occupy WORD

2 byte (unsigned EMS Hard
short) Version :ASCII
0x322E==’2.’

004EH EMS Hard Version 3-4 R Occupy WORD

2 byte (unsigned EMS Hard
short) Version :ASCII
0x3031==’01’

004FH INV Soft Version 1-2 R Occupy WORD

2 byte (unsigned INV Soft
short) Version :ASCII
0x312E==’1.’

0050H INV Soft Version 3-4 R Occupy WORD

2 byte (unsigned INV Soft
short) Version :ASCII
0x3430==’40’

0051H INV Soft Version 5-6 R Occupy WORD

2 byte (unsigned INV Soft
short) Version :ASCII
0x0000==’ ’
0052H INV Soft Version 7-8 R Occupy WORD
2 byte (unsigned INV Soft
short) Version :ASCII
0x0000==’ ’

0053H CHA Soft Version 1 2 R Occupy WORD

2 byte (unsigned CHA Soft
short) Version :ASCII
0x312E==’1.’

0054H CHA Soft Version 3 4 R Occupy WORD

2 byte (unsigned CHA Soft
short) Version :ASCII
0x3430==’40’

0055H CHA Soft Version 5 6 R Occupy WORD

2 byte (unsigned CHA Soft
short) Version :ASCII
0x0000==’ ’

0056H CHA Soft Version 7 8 R Occupy WORD

2 byte (unsigned CHA Soft
short) Version :ASCII
0x0000==’ ’

0057H Control Hard Version 1 2 R Occupy WORD

2 byte (unsigned Control Hard
short) Version :ASCII
0x322E==’2.’

0058H Control Hard Version 3 4 R Occupy WORD

2 byte (unsigned Control Hard
short) Version :ASCII
0x3031==’01’

0059H BAT Type R Occupy WORD BAT Type:

2 byte (unsigned 0x10==16:Smile 5
short) 0x03==3:M48100
0x0D==13:M48112
0x02==2:M4860
005AH BAT Soft Version 1 2 R Occupy WORD
2 byte (unsigned BAT Soft
short) Version :ASCII
0x312E==’1.’
 005BH BAT Soft Version 3 4 R Occupy WORD
2 byte (unsigned BAT Soft
short) Version :ASCII
0x3530==’50’

005CH BAT Hard Version 1 2 R Occupy WORD

2 byte (unsigned BAT Hard
short) Version :ASCII
0x312E==’1.’

005DH BAT Hard Version 3 4 R Occupy WORD

2 byte (unsigned BAT Hard t
short) Version :ASCII
0x3031==’01’

1. Annex
Note 1 battery warning
Alarm code Description
Bit 0 Temperature difference
Bit 1 Circuit breaker turn off
Bit 2 Over temperature
Bit 3 Low temperature
Bit 4 Over charging current
Bit 5 Over discharging current
Bit 6 Cell voltage difference
Bit 7 Over cell voltage
Bit 8 Under cell voltage
Bit 9 Software mode inconsistency
Bit 10 Temperature sensor failure 1
Bit 11 Temperature sensor failure 2
Bit 12 Current error
Bit 13 MOSFET failure

Note 2 battery fault

Alarm code Description
Bit 0 Under cell voltage shut down
Bit 1 Over temperature shut down
Bit 2 Master battery over cell voltage 1
 Bit 3 Slaver battery over cell voltage 1
Bit 4 Master battery over cell voltage 2
Bit 5 Slaver battery over cell voltage 2
Bit 6 Over charging current
Bit 7 Over discharging current
Bit 8 Over 10 minutes in standby mode
Bit 9 SOC calibration

Note 3 Inverter warning

Alarm code Description
Bit 0 Utility loss
Bit 1 Over temperature
Bit 2 PV over voltage
Bit 3 Vacwarnging
Bit 4 Fac warning

Note 4 Inverter fault

Alarm code Description
Bit 0 GFCI failure
Bit 1 AC current sensorfailure
Bit 2 DCI failure
Bit 3 DC bus high
Bit 4 Fan failure
Bit 5 Isolation failure
Bit 6 Relay check failure
Bit 7 EEPROM R/W failure
Bit 8 Internal communication failure
Bit 9 SOC calibration
Bit 10 Consistency failure

Maste device send command to read :

Data format：
addr_deive + func_code + register_H + register_L + Num_Reg_H + Num_Reg_L +
CRC_L + CRC_H

Data:
0x55 0x03 0x00 0x00 0x00 0x0D 0x89 0xDB

Slave device(inverter) response:

Data formant:
addr_deive + func_code+ Num_Byte+ byte * Num_Byte + CRC_L+ CRC_H
data:
0x55 0x03 0x1A 0xFC 0x18 0x00 0x00 0x03 0xB6 0x00 0x01 0x00 0x01 0x00 0xFF
0x01 0x00 0x00 0x00 0x00 0x00 0x01 0x00 0x00 0x02 0x00 0x00 0x00 0x01
0x57 0x5D

0x55 0x03 0x1A

0xFC 0x18 /*** (FC18)Hex = (-1000 )Dec ***/
0x00 0x00
0x03 0xB6 /*** (03B6)Hex = (950)Dec ***/
0x00 0x01
0x00 0x01
0x00 0xFF
0x01 0x00
0x00 0x00
0x00 0x00
0x01 0x00 /* (0100)Hex = (256)Dec, 256W */
0x00 0x02 /* (00020000)Hex = (131072)Dec,131072*0.01KWh = 1310.72.36KWh */
0x00 0x00
0x00 0x01 /*** (00010000)Hex = (65536)Dec ,65536*0.01KWh = 655.36KWh***/
CRC_L CRC_H